During our analysis of your web application, we were able to intentionally generate database specific errors. By causing a system to generate errors such as these, it is often possible to determine the database version and inject database command syntax that would allow us to extract data.

However, during our review of the system output, we were unable to identify the database version preventing us from exploiting this further. The danger exists in that a determined hacker might be able to determine the proper syntax and extract data or gain control of the system.

The extent of the damage that can be caused by this vulnerability varies greatly depending on environment and configuration. While input validation via webapp may cause a database to "throw" an error, the database configuration will also play an important role in determining how much it can be altered. A remote attacker may be able to gain access to very sensitive information, or gain administrative access (total control of the entire database functionality). For example, certain configurations of MS SQL server will allow one to create user accounts with the ability to take control of the Windows server that hosts